Google GSuite

This page provides a walkthrough of how to configure Cloud CMS Single Sign On (SSO) for Google GSuite.

Google GSuite provides support for SSO (single-sign-on) to allow users to authenticate to Cloud CMS using their Google accounts. Google plays the role of the Identity Provider and uses SAML 2.0 to assert authentication to Cloud CMS.

You can learn more about Google GSuite here:

https://gsuite.google.com/

Create a SAML App

To configure Cloud CMS to use Google GSuite, you must first log in to GSuite as the Google GSuite administrator.

Bring up the menu on the left-hand side, go under Apps and select SAML Apps.

Click on the + button to create a new SAML App.

This will bring up a modal dialog that will let you pick from pre-configured application types. It'll look something like this:

Click on Setup My Own Custom App.

The next screen will show you some important information that you should keep track of.

We advise keeping track of the following in a text editor (you'll need them later).

The SSO URL. This looks like

https://accounts.google.com/o/saml2/idp?idpid={your_identity_provider_id}

The Certificate PEM. Download the certificate and open it with text editor. It looks something like this:

Then click on Next.

The next screen lets you set up some basic information for your SAML App.

We recommend naming it Cloud CMS to keep things simple.

On the next screen, you will need to tell Google about Cloud CMS.

The values you should fill in here will depend on where your Cloud CMS UI lives.

If you are a SaaS customer and your subdomain is abc, then you would fill in the following:

ACL URL: https://abc.cloudcms.net/saml/consume
Entity ID: abc.cloudcms.net
Start URL: https://abc.cloudcms.net

In addition,

You should leave Signed Response unchecked.
For Name ID, leave this as Basic Information > Primary Email.
For Name ID Format, leave this as Unspecified.

Then click on Next.

You should now set up SAML Attribute mappings for the following properties:

email
firstName
lastName

Use the screen to set things up so that it looks more or less like this:

And then click on Finish.

Enable your SAML App

You should now see your SAML App appear in the list of SAML Apps you've configured for GSuite.

Click on the SAML App to bring up its detail view.

Click on Edit Service.

Make sure that "ON for everyone" is selected and click on Save.

This will enable the SAML App and make it possible for Cloud CMS to log in using SSO.

Configure Cloud CMS

In the previous steps, we set up Google GSuite to support a SAML SSO flow that will originate from Cloud CMS. We now need to set up Cloud CMS to connect to Google GSuite to initiate and complete this flow.

For the SSO Type, select SAML 2.0 and the configure the first set of fields as shown here:

For SAML SSO URL, put in the value for the Google GSuite SSO URL from above. This will look like:

https://accounts.google.com/o/saml2/idp?idpid={your_identity_provider_id}

Fill in the correct value for the {your_identity_provider_id} as per the URL you retained previously.

For SAML Issuer, put in the value for the Google GSuite Entity ID. This will look like:

{subdomain}.cloudcms.net

Fill in the correct value for your Cloud CMS subdomain.

Under Certificate, paste in the PEM value of your certificate.

And add the following user field mappings

The user field mappings will pull the firstName and lastName SAML Assertions (which you told Google GSuite to supply) into your Cloud CMS user accounts. That way, you'll be able to tell who is who. The primary ID for any synchronized Google users into Cloud CMS is their email address and the email address will automatically appear in the Cloud CMS user's email property.

Click on Update to save your changes.

Trying it out

We recommend logging out of both Cloud CMS and Google to try this out.

To see this in action:

Go to your Cloud CMS login page:

https://{subdomain}.cloudcms.net

Cloud CMS will redirect you to Google's login, similar to this:

Log in to Google. Just provide your username and password to Google like you normally would.
You'll be redirected back to Cloud CMS. And then you'll automatically be signed in. In the upper-right hand corner, you'll see your authenticated user information, like this:

Cloud CMS automatically parses the SAML 2.0 response from Google and validates it. It uses the email, firstName and lastName information to synchronize the user account.

If the user account doesn't yet exist within Cloud CMS, it is created.

It if already exists within Cloud CMS, it is updated when you log in, automatically keeping your Cloud CMS account information in sync with Google GSuite.